https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-11T18:05:24.986002+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-123812 fkie_cve-2026-123812 2026-11-11T18:05:24.988334+00:00

Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 1.8.7, the create_dynatrace_notebook registration in src/index.ts performs a persistent document-write action without calling requestHumanApproval, although the project's other write tools use that gate to obtain operator consent. A caller can create tenant-visible notebooks containing attacker-controlled Markdown or DQL content, and tenant users may later execute embedded DQL when opening the notebook. The tool also lacks a destructiveHint annotation that would signal its side effects to MCP clients. This issue is fixed in version 1.8.7.

 https://db.gcve.eu/vuln/ghsa-pc2w-4mq8-32qw GHSA-pc2w-4mq8-32qw — @dynatrace-oss/dynatrace-mcp-server's create_dynatrace_notebook missing the human-approval gate 2026-11-11T18:05:24.988430+00:00

Affected: npm: @dynatrace-oss/dynatrace-mcp-server

### Summary A missing human-approval gate on the `create_dynatrace_notebook` tool allows a caller to create persistent tenant-visible documents containing arbitrary content (including embedded DQL that other users execute when opening the notebook) without operator consent.

### Details `dynatrace-mcp-server` registers six write tools: `send_slack_message`, `send_email`, `send_event`, `create_workflow_for_notification`, `make_workflow_public`, and `create_dynatrace_notebook`. Five of these call `requestHumanApproval()` before executing the side-effect, which elicits the operator's explicit consent through the MCP elicitation protocol. The CHANGELOG explicitly states these approval gates were added "to ensure user consent and prevent unintended actions."

`create_dynatrace_notebook` does not call `requestHumanApproval()`. The tool was introduced in a separate release from the approval-gate retrofit and was left ungated. As a result, a caller can create persistent, tenant-visible Dynatrace notebooks containing arbitrary content with no operator confirmation. Notebooks can include embedded DQL queries that later execute under the permissions of any tenant user who opens them.

The vulnerable code is in `src/index.ts`, lines 1563-1601:

```typescript tool( 'create_dynatrace_notebook', 'Create Dynatrace Notebook', 'Create a new notebook in the Dynatrace platform ...', { name: z.string().describe(/* ... */), description: z.string().optional().describe(/* ... */),…